Email Header Analyser
Paste the full headers from a message (“Show original” in most clients) to read the SPF, DKIM and DMARC verdicts as the receiving server recorded them, and follow the delivery hops.
About
Every message carries a trail of headers that record how it travelled and how it was authenticated. This tool reads a pasted header block and pulls out the parts worth looking at: the SPF, DKIM and DMARC verdicts the receiving server wrote down, the delivery hops with their timestamps, and the addresses a reply would go to.
How to use
- Open the message and choose the option to show the original or full headers.
- Paste the whole block into the box, including the Received lines.
- Analyse it, then read the badges first and the hop table second.
Frequently asked questions
Where do I find raw headers?
In Gmail it is Show original, in Outlook it is message properties, and in most desktop clients there is a view source option. The important part is to copy everything, not just the top few lines.
What do the SPF, DKIM and DMARC results mean?
They are the receiving server notes on whether the sending IP was authorised, whether the signature verified, and whether the domain policy was satisfied. A failure in any of them is a strong hint about why a message landed in spam.
Why are timestamps listed in UTC?
Received headers can carry different time zones, so converting them all to UTC makes the gaps between hops comparable. Large gaps usually point at greylisting or a queue.
Can headers be forged?
The lines at the top are added by the last server and can be trusted more than those below them. Anything a sender wrote can be faked, which is why the authentication results matter more than the From line.